Listen to this Post
How the Vulnerability Works:
The vulnerability resides in the seed file decryption routine of gokey. A seed file is an encrypted blob containing high-entropy random data, protected by a user’s master password using AES-GCM. The correct process for deriving a secret key requires decrypting the entire seed file ciphertext using the master password to access the full entropy pool.
In affected versions (<0.2.0), a logic flaw caused the key derivation function (KDF) to incorrectly use only the fixed-length Initialization Vector (IV) and the AES-GCM authentication tag from the seed file’s encrypted header as the sole input entropy. The actual, much larger ciphertext payload containing the primary entropy was omitted.
This reduced the effective input entropy from the intended 240+ bytes to just 28 bytes (IV + tag). Since the IV and tag are stored alongside the encrypted seed, an attacker in possession of the seed file could directly feed these known values into the flawed KDF, bypassing the need for the master password. This allows deterministic regeneration of all passwords derived from that compromised seed file, completely breaking the cryptographic security model.
DailyCVE Form:
Platform: gokey
Version: <0.2.0
Vulnerability: Incorrect entropy derivation
Severity: High
Date: Not Specified
Prediction: Patch released 0.2.0
What Undercode Say:
Analytics:
$ gokey --version <blockquote> gokey version 0.1.3 $ gokey -p "masterPass" -s seed.gokey gen-password example.com Generated password: OldWeakPass123 $ gokey -p "masterPass" -s seed.gokey gen-password example.com Generated password: OldWeakPass123 //Deterministic output
Code snippet of flawed logic (conceptual):
// Vulnerable derivation (pseudo-code)
func deriveKey(masterPass, seedFile string) []byte {
header, _ := readSeedHeader(seedFile) // Extracts IV & Tag
// BUG: Uses only header.IV and header.Tag, ignoring ciphertext.
entropy := append(header.IV, header.Tag...)
return scrypt.Key(masterPass, entropy, N, r, p, keyLen)
}
How Exploit:
1. Attacker acquires the seed file (`seed.gokey`).
- Attacker extracts the 12-byte IV and 16-byte GCM authentication tag from the file header.
- Attacker runs the vulnerable gokey binary or recreates the flawed KDF.
- Attacker provides the extracted IV+Tag as the “seed” input, with any placeholder master password.
- The KDF successfully derives the same secret keys as the victim, allowing generation of all passwords.
Protection from this CVE:
- Upgrade to gokey version 0.2.0+.
- Regenerate all secrets created with `-s` flag using patched version.
- Rotate all impacted passwords/keys in dependent systems.
- Seed file confidentiality remains important post-patch.
Impact:
- Severe entropy reduction.
- Total secret compromise from seed file.
- Requires full secret rotation.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
